OLG Dresden - 4 U 1278/21

OLG Dresden - 4 U 1278/21
Court:	OLG Dresden (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6 GDPR Article 17(1)(d) GDPR Article 82(1) GDPR BGB
Decided:
Published:
Parties:
National Case Number/Name:	4 U 1278/21
European Case Law Identifier:
Appeal from:	LG Chemnitz 4 O 1100/20
Appeal to:
Original Language(s):	German
Original Source:	Rewis (in German)
Initial Contributor:	Sara Horvat

The Higher Regional Court of Dresden ruled that, in addition to claims arising from the GDPR, the enforcement of claims for injunctive relief under §823 and §1004 of the German Civil Code (BGB) is also possible.

English Summary

Facts

Two financial institutions (defendants) wanted to collect a claim from the plaintiff. During the procedure, the actual debtor, could not be found on at the Address which was originally stored. Therefore, the defendants searched for the new address with a Residents' Registration Office Request, where they were given the Data of the plaintiff and not the Data of the actual debtor, who both have the same name and surname and are actually father and son.

The plaintiff has requested to get all his Data removed from the storage of the defendants, since he was in fear to get a “Schufa” Entry (a kind of a register of debtors in Germany). Therefore, non-material damages in the amount of €10,002.00 were, in his opinion, justified. The defendants took the view that, the plaintiff's requests for deletion and injunctive relief were too vague and too broad. Moreover, the data processing by them had been lawful because a debtor with the same name existed. It was therefore not justifiable to prohibit them from processing any data in the future. In addition, retention obligations under tax law had to be observed. Finally, the storage also served to protect the plaintiff, because his address had been set as invalid for the present debtor record by setting a marker. There was a risk that the plaintiff would continue to be identified and contacted in the future in connection with the collection of the debt if his data were deleted. Because of the identity of the name and the fact that the actual debtor had not settled the claim, it was justified to continue storing the data in order to avoid future confusion.

The request was to brought also in the opinion of the court, therefore the plaintiff narrowed it down to “Name”, “Surname”, “Postal Address” and “Date of Birth”.

Holding

It is undisputed that not only the name of the plaintiff is stored with both defendants, but also his date of birth and residential address, even if the latter is marked with a blocking notice with the second defendant. It is irrelevant whether this data is actually already linked in the defendant's IT system in such a way that the plaintiff can be clearly identified, because such a compilation could easily be made if necessary. The defendants have not asserted and provided evidence that, due to the design of their respective database software, precautions have been taken to exclude such an allocation and thus the concrete identification of the plaintiff. If, as a result of this linking possibility, the data stored about the plaintiff is personal data of the plaintiff despite the identity of the name with the actual debtor, it is incumbent on the defendants either to delete this data in its own right or to take protective measures to ensure that a link that clearly points to the plaintiff is excluded in the future. In this regard, the plaintiff only has a claim that this happens, but not in what way the defendants must proceed in this regard. Just as in the area of negatory and quasi-negatory claims under §1004 of the German Civil Code, where the decision as to the means by which the impairment is to be eliminated is left to the interferer and where the court regularly refrains from ordering specific measures.

The Data was processed unlawfully, since there was no legal ground for processing (Article 6 GDPR), since he was not a costumer of the Bank and did not give consent, also a processing under Article 6(1)(c) is not possible, since there were no actual obligation to store that data. Therefore the data had to be erased (Article 17(1)(d) GDPR). The debtor of an erasure claim under Art. 17 GDPR also has the choice of how to remedy a violation of the data subject's protection rights resulting from the compilation of individual information.

The assertion of a claim for injunctive relief under §823 (1) in conjunction with §1004 of the German civil Code is possible in addition to the rights under the GDPR, as this is the only way to ensure complete protection with regard to the processing of personal data of natural persons, which in turn unlawfully interferes with the right of personality of the data subject under Article 1 and Article 2 Basic Act, even if such a claim is neither explicitly regulated in the General Data Protection Regulation nor, for example, pursuant to Article 17 GDPR such a claim for injunctive relief could be assumed via an interpretation.

If such a right to injunctive relief were denied, there would be insufficient protection of individual rights. It cannot therefore be assumed that the GDPR, because it does not contain any express injunctive relief, has a blocking effect. The requirements for such injunctive relief were met. As already explained, the processing of the personal data was not lawful, and there is also a risk of repetition. An unlawful encroachment on the general right of personality of the person concerned gives rise to a factual presumption that there is a risk of repetition. This presumption can be rebutted, whereby strict requirements must be met; in principle, a cease-and-desist declaration with a penalty clause is required. In the present case, the defendants have not rebutted the presumption of a risk of repetition. Rather, they insist that the data processing was lawful and is also permitted to them in the future. However, they could only be required to refrain from processing the personal data to the extent that the plaintiff is listed as a debtor of the claim from the enforcement order of the original judgement. This is because it cannot be ruled out for the future that another creditor will have claims against the plaintiff, the collection of which will be entrusted to the defendants. In this context, the authorization to process data could not be denied. This also applies insofar as the defendants were entitled to store and process the plaintiff's personal data in connection with this legal dispute.

The court also decided, that the plaintiff is not entitled to claim damages against the defendants pursuant to Article 82(1) GDPR. Because the plaintiff has not conclusively demonstrated the occurrence of damage causally attributable to the defendants' breach of duty. The claim for damages asserted in the amount of €10,000.00 is not supported at all in the submission.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

OLG Dresden
4 U 1278/21
from 14.12.2021
In addition to claims from the GDPR, the enforcement of claims for injunctive relief remains
according to §§ 823, 1004 BGB possible.
REWIS: open. smart. legal.
Case law database
Information provided without guarantee
URL: https://rewis.io/s/u/ZusS/
OLG Dresden
4. Civil Senate
4 U 1278/21 of December 14, 2021
verdict | OLG Dresden | 4. Civil Senate
motto
A person's name is also included in naming identity with third parties
personal date if the identity is secured by additional information
is.
Statutory retention requirements do not justify not
to be allowed to permanently store lawfully collected data; it is the task of
custodian to organize his database in such a way that access
on unlawfully obtained data of the data subject is not possible.
In addition to claims from the GDPR, the enforcement of
Claims for injunctive relief according to §§ 823, 1004 BGB possible.
Can it not be inferred from the applicant's submissions that he
unlawful data processing violates interests worthy of protection
has been made, immaterial damages are out of the question.
tenor
On the appeal of the plaintiff, with the rejection of the appeal, the
Judgment of the Chemnitz Regional Court of May 31, 2021 - 4 O 1100/20 - as follows
modified:
The defendants are convicted, the following relating to the plaintiff
Delete data: "A...... B......, K...... H...... yyy, 00000 C....., born on
xx.xx.19xx".
The defendants are convicted of using any processing and dissemination
automated processes or any such series of operations as this
Collecting, recording, organizing, sorting, storing
Adaptation or modification, reading out, querying, use,
disclosure by transmission, dissemination or any other form
the provision, matching or linking, restriction, the
are due to the person of the plaintiff to refrain from such
happen in connection with the data mentioned under point 1 of the
Plaintiff as debtor of the claim of the defendant to 2) from the
Execution notice of the District Court of Hagen dated December 21, 2015 -
Business reference 15-2538979-0-0.
1.
2.
3.
4.
1.
1.
2.
2 4 U 1278/21 of December 14, 2021 | rewis.io
1
2
3
The defendants are sentenced to provide evidence to the plaintiff
Deletion of the data under point 1 to third parties.
The defendants are convicted as joint and several debtors, pre-trial
Attorney's fees of €147.56 to be paid to the plaintiff.
Moreover, the application is dismissed
The plaintiff bears 10/11 of the costs of the legal dispute and the defendants each bear them
1/22
The judgment is provisionally enforceable. The defendants can enforce enforcement
Avert security in the amount of € 2,000.00 each, if not the plaintiff
provide security in the same amount before enforcement. The plaintiff can
Enforcement due to the costs of providing security in the amount of 110% of the
avert the amount to be enforced, if not the defendants before enforcement
provide security in the same amount.
The revision is not permitted.
decision
The item value is set at €11,002.
I
The plaintiff seeks to condemn the defendants, all concerning him
to delete personal data, to refrain from processing them, him
to pay reasonable damages and to provide alternative information.
The defendant to 2) is a debt collection company. She received from K...... Bank im
July 2015 the order to collect a claim from a debtor named A...... B......,
residing at C......xx, 00000 C......, born on xx.xx.19xx, to move in. the
Defendant 2) obtained on December 21, 2015 against A...... B......, C...... xx, 00000 C......,
an enforcement order. The debtor could not be identified as a result
Defendant 2) therefore commissioned Defendant 1) with a
Resident registration request. This then informed that an A...... B......,
born xx.xx.19xx, at the address K...... H...... yyy, 00000 C...... (residential address
of the plaintiff) is resident. As part of recovery efforts in the year
In 2017 it turned out that the plaintiff was not the debtor of the K......
bank, but the plaintiff's son of the same name who was born on zz.zz.19zz,
who lived under the address C...... xx in 00000 Chemnitz. The requirement
the K...... bank has not yet been settled. Plaintiff's Counsel
unsuccessfully requested both defendants in December 2019 to delete the data relating to him
stored data.
3.
4.
5.
2.
3.
4.
3 4 U 1278/21 of December 14, 2021 | rewis.io
4
5
6
The plaintiff has taken the view that he has a right to erasure
and omission of processing. A right to data processing
does not exist because he is not the debtor of the claim. As he fear
to have received a Schufa entry is an immaterial one
Compensation in the amount of €10,002.00 justified. The defendants have
Considered the plaintiff's requests for cancellation and injunctive relief
are too vague and too broad. The data processing by them is
moreover been lawful because a debtor with the same name existed. It
is therefore not justifiable to allow them any processing in the future
prohibit. In addition, storage obligations according to
to observe tax law. Finally, the storage also serves to protect the
Plaintiff, because his address was set as invalid for the marker
present debtor data record has been set. There is a risk that
the plaintiff will continue to be determined in the future as part of the recovery of the claim
and will be contacted if his data is deleted. Because of the
Name identity and that not settled by the actual debtor
It was justified to demand that the data continue to be stored for future use
to avoid confusion. The plaintiff has a claim for damages
not to.
In its judgment of May 31, 2021, the district court declared the action inadmissible
rejected. The most recent applications had no enforceable
Content for which the plaintiff submitted after the hearing
There is no need for legal protection for auxiliary requests.
The plaintiff's appeal, with which he his applications, is directed against this
followed up. In the oral hearing on October 19, 2021, he gave his
Complaint revised and
now requests
the defendants are sentenced following, relating to the plaintiff
Data record to be deleted: A...... B......, K...... H...... yyy, 00000 Chemnitz, date of birth
xx.xx.19xx.
the defendants are convicted of any processing and dissemination with the help of
automated processes or any such series of processes in connection with
the plaintiff's data set mentioned in paragraph 1, such as the collection, the recording, the
Organizing, ordering, storing, adapting or changing
Reading, querying, use, disclosure by transmission,
distribution or any other form of provision, matching or
Link, the restriction that is due to the person of the plaintiff,
to stop.
the defendants are asked to provide proof of the deletion of all data such as
under items 1 and 2 of the complaints also against third parties after the legal force of the
present judgment.
1.
2.
3.
4 4 U 1278/21 of December 14, 2021 | rewis.io
7
8th
the defendants are sentenced to a discretionary court order
to pay damages to the plaintiff.
the defendant to 1) is ordered to pay pre-trial legal fees in the amount of
€297.62 to pay.
the defendant to 2) is sentenced to pre-trial legal fees in the amount of
€297.62 to pay.
The defendant to 2) is alternatively sentenced to provide information as to whether they
personal data about the person of the plaintiff, A...... B......, K...... H...... yyy, 00000
C......, saved.
If this is the case, the defendant to 2) is sentenced to provide information about:
which personal data is specifically processed by you (e.g.
surname, first name, address, date of birth, profession of the plaintiff) as well as
for what purpose this data is processed. In addition, the
Defendant 2) sentenced to provide information about
the categories of the plaintiff's personal data being processed;
the recipients or categories of recipients who already receive this data
have and will be preserved in the future;
the planned storage period or the criteria for determining this period;
the existence of a right to correction or deletion of the data or to
restriction of processing;
if applicable, an existing right of revocation against this processing according to Art.
21 GDPR;
about the right of appeal to the competent supervisory authority;
the origin of the data.
Should automated decision-making including profiling take place
have, the defendants are convicted, meaningful information as well
Information about the logic involved as well as the scope and the desired
effect of such proceedings.
If a data transmission has taken place, the defendant to 2) will provide information
Condemns which guarantees according to Art. 46 GDPR existed.
The defendant to 2) is ordered to provide complete data information within the meaning of § 34
BDSG or Art. 15 DSGVO on the personal data concerning the plaintiff
to grant, which the defendant to 2) has stored, used and processed.
Alternatively, the defendant is sentenced to 2), represented by its CEO,
according to §§ 259 Abs. 2, 260 Abs. 2 BGB to ensure completeness and
to condemn the correctness of the data information they have previously provided on oath.
The defendants request
to dismiss the appeal.
4.
5.
6.
1.
2.
3.
4.
5.
6.
7.
8th.
9.
10
11.
5 4 U 1278/21 of December 14, 2021 | rewis.io
9
10
11
12
13
The defendants are defending the district court's judgment. You mean about them
Auxiliary requests should not have been decided because they are not pending
had become, an extension of the complaint in the appeal proceedings was lacking
Relevant not allowed. A claim for future injunctive relief is in
not justified by the general form. The data provided by the client of the
Defendant 2) "did not belong" to the plaintiff, either
if name and date of birth are identical. An accidental identity of
Data does not give every person affected by the identity the right
to request their deletion. The data processing is also therefore
lawful because the legitimate interest of the defendant prevails. In the
Defendant 2) as a debt collection company is regularly investigated
from incorrect addresses. But it was uneconomical, repeated claims
to have to assert against persons who are not debtors, only
because they have the same name as an actual debtor. The interests
of the plaintiff in the deletion would have to take a back seat. It is also
in his interest, not because of the underlying claim against the
actual debtor to be re-identified and contacted.
The defendants are already independent in the context of tax law
Legal reasons prevented from accessing the data stored about the plaintiff
Clear.
II.
The admissible appeal of the plaintiff is partly founded.
A
1.
a)
This is personal data within the meaning of Art. 4 No. 1
DSGVO, with which the plaintiff can be identified as a natural person.
This does not conflict with the fact that, in addition to the plaintiff, the actual
debtor there is a person who bears the same name. They think wrongly
Defendant, a claim for cancellation is already excluded because
the name does not "belong" to the plaintiff alone, but to several persons of the
of the same name existed. Notwithstanding this, the name belongs under Art. 4
GDPR on personal data, provided a person is sure about it
can be identified. If several people have the same name, the
Personal reference may be made via additional information that a
concrete connection to one of those affected by the same name
Justify persons (cf. Karg in: Simitis/Hornung/Spiecker (ed.),
6 4 U 1278/21 of December 14, 2021 | rewis.io
14
15
16
17
18
19
Data Protection Law, 2019, Art. 4 No. 1, loc.cit., marginal note 51). Such a connection lies
occurs if the person is identified either directly from the information
or by consulting further information or intermediate steps
is at least identifiable (cf. Karg in Simitis/Hornung/Spiecker (eds.),
Data Protection Law, 2019, Art. 4 No. 1, para. 46). That's how things are here. indisputable
not only the name of the plaintiff is stored for both defendants,
but also his date of birth and home address, also likes the latter
in the case of defendant 2) be provided with a blocking notice. It can
it remains to be seen whether this data already exists in the defendant's IT system
are connected in such a way that the plaintiff can be clearly identified, because
such a compilation is easily accomplished at least in case of need
could become. That against this due to the design of their respective
Database software precautions would have been taken to support such
exclude assignment and thus the specific identification of the plaintiff,
the defendants have not claimed and proved. So are they
Data stored about the plaintiff despite the identity of the name with the
actual debtor as a result of this link option
personal data of the plaintiff, it is incumbent on the defendants either, this
Delete data on its own or through safeguards
to ensure that a link clearly pointing to the plaintiff
is excluded in the future. The plaintiff is only entitled to
that this happens, but not in what way the defendants here
have to proceed. Just as in the area of negatory and
quasi-negatory claims from § 1004 BGB, in which the decision with
The means by which the impairment is to be eliminated is left to the disturber
remains and where the court regularly refrains from doing certain
Order measures (see instead of all BGH, judgment of December 14, 2017 - I
ZR 184/15 –, juris; Ebbing in: Erman, BGB, 16th edition 2020, § 1004 BGB, para. 6).
namely also the debtor of a cancellation claim according to Art. 17 GDPR
choice as he one from the compilation of individual information
resulting infringement of the property rights of the person concerned.
b)
Contrary to the opinion of the defendant, the processing of the data takes place
Plaintiff also not lawfully according to Art. 17 Para. 1d in conjunction with Art. 6 DSGVO.
aa)
The plaintiff has consented to the processing of his personal data
Data not granted, Art. 7, 6 Para. 1a) GDPR.
b)
The requirements of Art. 6 Para. 1b) GDPR are not met. After that lies
lawfulness if the processing is for the performance of a contract,
7 4 U 1278/21 of December 14, 2021 | rewis.io
20
21
22
the contracting party of which is the data subject, or for the implementation
pre-contractual measures are required, at the request of those concerned
person took place. However, the plaintiff is neither a contractual partner of the K...... Bank nor
the defendant. Whether the defendant in the context of their contractual relationship with the
K...... Bank or each other the data for the fulfillment of the respective contracts
were transmitted is irrelevant. Because according to the wording of the regulation
it comes down to the contractual relationship with the data subject - the
Plaintiff - on.
c)
The defendants cannot successfully rely on Art. 6 1c) GDPR in conjunction with § 147
AO appointed, because the deletion does not comply with the storage obligations
opposite.
According to this regulation, the processing is lawful if it is necessary for fulfilment
a legal obligation is required of the controller
subject. This must be a legal obligation (cf. Roßnagel
in Simitis/Hornung/Spiecker [editors] in data protection law, 2019, Art. 6 para.
1 para. 51). Data processing may be necessary in order to
documentation requirements e.g. B. according to § 147 AO (cf. Roßnagel a.a.O., Rn
54). Permission to process data is based on the fulfillment of the respective
legal obligation (cf. Roßnagel loc.cit.). Of the
The entire operational area of the
Correspondence relating to Kaufmann, insofar as it relates to the preparation,
Execution or cancellation of a commercial transaction, i.e
e.g. B. Orders, order confirmations, delivery notes, bills of lading or
Invoices (cf. Mues in Gosch, commentary on the tax code, status
01.04.2021, § 147 B para. 13 - juris). It depends on the form of correspondence
not to, so that letters within the meaning of the regulation also include faxes, telegrams, e-
Mails and also other messages sent by data transmission
(cf. Mues loc.cit.). The legal storage obligations according to § 147 AO
are not affected by the obligation to delete. The defendants are not
obliged to delete the business correspondence. Your Erasure Obligation
is limited to the name, address and date of birth of the
plaintiff, and thus to the data with which he can be clearly identified
can. If electronically stored databases do not contain
and subject to retention, personal or professional secrecy
underlying data, it is up to the taxpayer to
to organize that the auditor only on the recordable - and
data subject to retention can access. This can e.g. B. by suitable
Access restrictions or "digital blacking out" of those to be protected
information (cf. Federal Ministry of Finance: Principles for
proper keeping and keeping of books, records
and documents in electronic form and for data access from November 28th, 2019,
8 4 U 1278/21 of December 14, 2021 | rewis.io
23
24
25
26
172 - juris). On the business correspondence, the data that a
allow identification of his person to be redacted.
dd)
The lawfulness of the processing does not result from Art. 6 Para. 1f) either.
GDPR, because the interests of the plaintiff prevail in the context of the consideration.
According to this regulation, the processing is to protect the legitimate
interests of the person responsible or a third party, unless the
Interests or fundamental rights and freedoms of the data subject who
require the protection of personal data prevail. The concept of
legitimate interests is to be understood broadly. It includes both legal and
also economic and non-material interests (cf. Schantz in Simitis/Hornung/
Spiecker [editor] in data protection law, 2019, Art. 6 (1) para. 98). To the
legitimate interests of the defendant to 2) include the interest in a
the highest possible effectiveness of the debt collection service, i.e. on a possible basis
efficient receivables management (cf. AG Hamburg - St. Georg, judgment of
08/25/2020 - 912 C 145/20, para. 37 - juris). The bad debts of the creditors
should be kept as low as possible, the necessary liquidity of
Business enterprise preserved and the debtor subject to reimbursement so
be charged as little as possible with further costs (according to AG Hamburg - St.
Georg, loc.cit.). In view of this, the defendant to 2) has an interest in
the determination of the place of residence of the debtor not again to the plaintiff
determine and write to them in order to only after the use of the
plaintiff again to determine that this is not the right debtor. this
also corresponds to the interest of the 1st defendant), that of the 2nd defendant
has been entrusted with a resident registration request. She has it too
Danger that you with the from the client - the K...... Bank - communicated
Contact details, the address of the plaintiff is determined. The storage of the data
of the plaintiff prevents his renewed claim. Mandatory for them
Debt collection, however, is not. Even without such storage
debt collection remains possible (also AG Hamburg - St. Georg
a.a.O.). Although the plaintiff is thereby subjected to the risk in the future
being used again without justification. that risk
but he exposed himself by demanding the deletion of the data.
This is to be accepted by him (also AG Hamburg - St. Georg a.a.O.).
The plaintiff's interests in his right to informational
Self-determination prevail in the present case. Already through the
Processing his data without his consent will become his fundamental rights
from Art. 7, 8 GRCh affected. His data will be at a
Debt collection companies, such as defendant 2) and a company that
deals with resident registration inquiries, as saved by the defendant to 1),
without this being caused by a debt collection. the
9 4 U 1278/21 of December 14, 2021 | rewis.io
27
28
29
30
31
Storage of the plaintiff's data is based on the name identity with his
son and the associated confusion with the debtor. Although is
Contrary to the plaintiff's statement, a Schufa entry is not made, because
according to the submitted letter from Schufa dated April 17, 2020 (Annex K9)
only positive contract information about him is available there. Nevertheless it is in
It cannot be ruled out in the future that, upon request from the defendants, the data of
plaintiffs are disseminated and give the wrong impression
Debt collection company is collecting a claim against him or
been tasked with finding out his home address, which went against his
creditworthiness speaks. In view of the high value attached to the Charter of Fundamental Rights
of the European Union to the protection of personal data in Art. 8
GRCh and thus the right to informational self-determination
the interest of the defendants in a simple collection of debts without
erroneous determinations of addresses.
c)
The right to erasure also does not apply in accordance with Art. 17 Para. 3 b) GDPR.
As already stated under point cc), there is a legal obligation to
Storage of business documents according to § 147 AO dem
claim for cancellation.
2.
The plaintiff has a claim against the defendants for injunctive relief
processing of his personal data insofar as he is the debtor
the claim from the enforcement notice of the district court of Hagen dated
December 21, 2015, §§ 823, 1004 BGB.
The assertion of a claim for injunctive relief from Sections 823 (1) in conjunction with
1004 BGB, in addition to the rights from the General Data Protection Regulation,
because only such a complete protection in terms of processing
personal data of natural persons are guaranteed
can, which in turn affects the personal rights of the data subject pursuant to Art. 1, 2
GG intervenes unlawfully, even if such a claim in the
General Data Protection Regulation is neither explicitly regulated nor, for example, according to Art.
17 GDPR on an interpretation of such an injunctive relief
could be accepted (Senate, judgment of August 31, 2021 - 4 U 324/21 - juris;
Resolution of April 19, 2021 - 4 W 243/21 - juris; as well as district court Darmstadt,
judgment of. May 26, 2020 - 13 O 244/19, para. 38 - juris; o.a. however VG
Regensburg, court decision of August 6th, 2020 - Rn 9 K 19.1061 - juris; cf. to
Dispute Halder, jurisPR-ITR 4/2021 Note 5). Would you like one?
Denying an injunctive relief would not be sufficient
Individual legal protection given. It is therefore not to be assumed that the
General Data Protection Regulation because they do not have an express
10 4 U 1278/21 of December 14, 2021 | rewis.io